Legal
Privacy Policy
What Refract collects when you use Refract, why we hold it, who else processes it, and how to get it back or have it deleted.
Last updated 7 August 2026
1.The short version
- We collect what is needed to run the product: your account, your designs, and your plan.
- There are no analytics SDKs, advertising trackers or third-party marketing pixels in the web app or the mobile apps.
- We never see your card number.
- We do not sell or share your personal information, and we do not use your designs to train machine-learning models.
- Delete your account and your content goes with it.
2.What we collect
Account information. Your name, email address and profile image, handled through our authentication provider. If you sign in with Google or Apple, we receive only the profile details that method returns, never your password.
The things you make. Projects, screens, layouts, text, brand kits and the screenshots and images you upload. These are stored so the app can show them back to you and export them.
Subscription information. Which plan you are on, its status and renewal date, and the store or processor it came from. Card numbers are handled by Stripe, Apple or Google and never reach our servers.
Usage counters. How many projects you have and how many exports you have run this month, so plan limits can be applied.
Connected social accounts. Only if you choose to connect one: the account handle and the access tokens needed to publish on your behalf. Tokens stay on our servers, are never sent to the browser or the app, and are deleted when you disconnect the account.
Technical logs. Our infrastructure providers keep short-lived request logs (IP address, timestamp, and what failed), used to keep the service running and to investigate abuse.
3.What we do not collect
No advertising identifiers, no cross-site tracking, no behavioural profiling, no session recording, and no third-party analytics. The mobile apps do not ask for your contacts, your location or your photo library beyond the images you explicitly pick to import.
4.Why we hold it
To provide the service you asked for. That is the contract between us, and it covers your account, your content and your subscription. To comply with legal obligations such as tax records for payments. And on the basis of our legitimate interest in keeping the service secure, debugging failures and preventing abuse.
We do not send marketing email unless you opt in, and you can opt out again from any such message.
5.Who else processes it
We use a small number of processors. Each one only receives what its job requires:
| Processor | What it does | What it sees |
|---|---|---|
| Clerk | Accounts, sign-in and web subscription management | Name, email address, profile image, plan status |
| Stripe | Card processing for web subscriptions, via Clerk | Payment details, billing address, transaction records |
| Convex | Application database and file storage | Projects, screens, uploaded images, plan and usage records |
| RevenueCat | Validates iOS and Android purchases and tells us what you own | Your account id, store receipts, subscription status |
| Apple / Google | Sell and bill in-app subscriptions | Payment details and transaction records held by them, not us |
| Get Illustrations | Supplies the illustration and icon library | Search terms sent from our servers, not your identity or IP address |
We may also disclose information where the law requires it, or to protect our rights or someone's safety. If Refract is ever acquired, your information may transfer with the service, and you will be told before that happens.
6.Where it is held
Our providers operate infrastructure in the United States and the European Union, so your information may be processed outside the country where you live. Where personal data leaves the UK or EEA, we rely on our providers' Standard Contractual Clauses and equivalent safeguards.
7.How long we keep it
Your account and content stay until you delete them. Deleting your account removes your projects and uploaded files; encrypted backups age out within 30 days. Records we must keep for tax or accounting, such as the fact and amount of a payment, are kept as long as the law requires, typically six to seven years.
8.Your rights
You can ask us to give you a copy of your personal information, correct it, delete it, restrict or object to how we use it, or send it to another provider. You can also complain to your data protection authority, which in the UK is the Information Commissioner's Office.
If you are in California, you have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA.
Most of this you can do yourself: your designs export at any time, and deleting your account removes your data. For anything else, email support@refract.design and we will respond within 30 days.
9.Security
Traffic is encrypted in transit, and data is encrypted at rest by our infrastructure providers. Access to production data is limited to people who need it. Social tokens are held server-side only. No system is perfectly secure, so if a breach affects you we will tell you and the relevant regulator as the law requires.
10.Children
Refract is not for children. You must be at least 16, or the age of digital consent where you live if that is higher. If we learn we hold a child's information, we delete it.
11.Changes
If we change this policy in a way that materially affects you, we will give notice by email or in the app before it takes effect. The date at the top always shows the current version.
12.Contact
Privacy questions and requests: support@refract.design. The agreement covering use of the service is in our terms of service.